Overview

overview

10

Static

static

4938c74639...d5.exe

windows7_x64

10

4938c74639...d5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4938c74639ddd5cd77b4a25326dde2ee2bc1b56249d7001688d39b223268d2d5

  • Size

    3.4MB

  • Sample

    220524-t92clahhg2

  • MD5

    cec18a3bcd163583c7ea013b611373a7

  • SHA1

    623e208522b88f56920eeeb291d1ac1328cf3942

  • SHA256

    4938c74639ddd5cd77b4a25326dde2ee2bc1b56249d7001688d39b223268d2d5

  • SHA512

    acaeb674587bcdd4e9c35a58f8093f1644adf22d859412a4b69f9081f7a230ae563ae2aac6fc4a207e2fb03131ae10bb05c45772650e7a2cfbe316fa7e317e54

Score
10/10
dcratgozi_rm3bankerinfostealerpersistenceratsuricatatrojanupx

Malware Config

Targets

    • Target

      4938c74639ddd5cd77b4a25326dde2ee2bc1b56249d7001688d39b223268d2d5

    • Size

      3.4MB

    • MD5

      cec18a3bcd163583c7ea013b611373a7

    • SHA1

      623e208522b88f56920eeeb291d1ac1328cf3942

    • SHA256

      4938c74639ddd5cd77b4a25326dde2ee2bc1b56249d7001688d39b223268d2d5

    • SHA512

      acaeb674587bcdd4e9c35a58f8093f1644adf22d859412a4b69f9081f7a230ae563ae2aac6fc4a207e2fb03131ae10bb05c45772650e7a2cfbe316fa7e317e54

    Score
    10/10
    dcratgozi_rm3bankerinfostealerpersistenceratsuricatatrojanupx

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Gozi RM3

      A heavily modified version of Gozi using RM3 loader.

      bankertrojangozi_rm3

    • suricata: ET MALWARE DCRat Initial CnC Activity

      suricata: ET MALWARE DCRat Initial CnC Activity

      suricata

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks